Summary
- North Korean authorities arrested former military hackers for stealing funds from two state banks and laundering the money through cryptocurrency.
- The group allegedly breached Central Bank systems, converted crypto to cash via Chinese brokers, and used small transfers to evade detection.
- North Korean hackers remain major players in global crypto exploits, accounting for a significant majority of hack and scam losses through early 2026.
North Korean authorities arrested former military hackers accused of stealing state funds from two banks and laundering the proceeds through cryptocurrency.
The group, according to a Daily NK report citing an anonymous source in Pyongyang, allegedly breached the internal systems of the Central Bank of the DPRK and Foreign Trade Bank, diverted foreign currency and state trade funds, and moved the money into overseas crypto wallets.
The report could not be independently verified.
Chinese brokers then converted the assets into U.S. dollars and yuan, Daily NK said. Contacts in the border cities of Sinuiju and Hyesan allegedly exchanged the crypto for cash in real time, with the group splitting transfers into small amounts to avoid detection and using encrypted messaging apps, unregistered phones and Chinese wireless equipment.
North Koreas National Intelligence Agency arrested the suspects at a Pyongyang safe house on July 12 after officials detected discrepancies in foreign-currency payment approvals and suspicious overseas IP activity, according to the report.
The laundering route mirrors methods used by North Korean hacking groups to cash out stolen crypto.